Assume that I operate a user-facing online file syncing service that offers end-to-end encryption of large files, such that files are encrypted client-side first, then uploaded to the server for storage. Assume that at present, files are encrypted with AES-CBC.
My question is, how is a such a service to safely facilitate long-term saving of data if longevity implies that files may need to be re-encrypted with newer algorithms in the future? That is, if a user has built up a collection of 10,000 files at 1GB a file over the last 10 years, and this service now needs to upgrade files to AES-GCM, how is it to do so? Manually downloading, decrypting CBC, re-encrypting with GCM, then uploading to server could take the client months to complete.
Proxy re-encryption seems a related topic, but having looked into that, it seems mostly related to the re-encryption of ciphertexts having been encrypted with RSA/asymmetric encryption, rather than symmetric encryption. Otherwise, if we can offload AES (or any arbitrary algorithm) re-encryption to a proxy server, that would be great, but doesn't seem to be the case with this type of encryption.
Is there a cryptographic solution to this, or is this more of a practical problem that must be solved through the only way possible—coordinating efficient, multi-day communication of client and server to ensure a safe upgrade process?
To be clear, I don't mean this in an enterprise capacity, but as a practical user-facing tool like Dropbox. If I'm storing many terabytes of encrypted data for millions of users, how do I facilitate encryption upgrades?